bundle: protect Brewfile formulae during cleanup

[AbdelrahmanHafez]

re #21351 and #21350

bundle cleanup protects Brewfile formulae only when it directly uninstalls another formula. Cask removal and final cleanup can also autoremove them.

This moves the existing protection before all forced cleanup operations. It adds receipt checks for cask removal, cleanup without uninstall targets, and dry runs.

Reproduce on a disposable Homebrew installation:

brew install hello
brew tab --no-installed-on-request hello
printf 'brew "hello"\n' > /tmp/cleanup-Brewfile
brew bundle cleanup --force --formula --file=/tmp/cleanup-Brewfile
brew list hello

Before this change, final cleanup removes hello despite its Brewfile entry. With this change, hello remains installed.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Astra 6 High generated the solution and the tests. Opus 5.5 High reviewed them independently. Tests reproduced the failure before the fix and passed afterward. I reviewed everything in this PR and believe I have good understanding for the problem and the solution. Will do my best answering without AI. :)

---

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1bd7024c-ad5d-4c43-a0ef-029f0fa03409

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between f2996fc and 10e1066.

---

---

📒 Files selected for processing (2)

• Library/Homebrew/bundle/subcommand/cleanup.rb
• Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📜 Recent review details

🧰 Additional context used

📚 Code guidelines (1)

Generated by CodeRabbit — auto-discovered

---

📓 Path-based instructions (1)

Test command behavior and its observable effects, including stdout, stderr, exit status, and state changes as relevant.

📄 CodeRabbit inference engine (Generated by CodeRabbit)

Files:

• Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb

---

---

---

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Cleanup now correctly records Brewfile-listed formulae as explicitly requested when removing casks or running general cleanup, even if no formulae are being uninstalled.
  • Running cleanup without force continues to leave formula installation records unchanged. This keeps recorded installation status consistent with the Brewfile while avoiding unintended changes during a non-forced cleanup.

📝 Summary

Walkthrough

Forced cleanup now marks Brewfile formulae as installed on request before cask or formula uninstalls. Tests cover receipt handling during forced cleanup and confirm that cleanup without force leaves the receipt unchanged.

Changes

Brewfile formula receipt handling

Layer / File(s)	Summary
Mark formulae before cleanup operations Library/Homebrew/bundle/subcommand/cleanup.rb, Library/Homebrew/test/cmd/bundle/cleanup_subcommand_spec.rb	Forced cleanup marks Brewfile formulae as installed on request before uninstall operations. Tests cover cask uninstall, brew cleanup, and cleanup without force.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: mikemcquaid

---

---

Merge Risk: ⚪ Minimal · up to 10e10

The cleanup change has no identified issue requiring resolution before merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 10e10

The change protects declared packages earlier without changing cleanup confirmation or package-selection rules. No introduced security vulnerability was established. Permission-recovery failures and concurrent receipt updates still depend on existing behavior that was not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected change affects installed formula retention within the selected Homebrew installation. Direct receipt-write targets remain constrained by installed-name membership and receipt existence; protection now applies during cask-only and no-target forced cleanup as well.

Trust Boundaries and Controls

• observed — On EACCES, the existing helper invokes brew tab with a fixed marking option and selected installed names through an argument-array subprocess. Its documented purpose is to re-enter privilege wrappers. The PR makes this recovery path reachable in additional cleanup modes; external wrapper authorization was not available for verification.

Resilience and Maintainability Implications

• inferred — A failed permission-recovery subprocess can leave protection incomplete because its success status is ignored. This predates the PR: formula cleanup already used the same fallback, while cask-only and no-target cleanup previously performed no marking at all. It remains a protection limitation, not an established introduced security regression.

Hardening Proposals

• proposed — Consider requiring successful permission-recovery marking before proceeding to destructive cleanup, so incomplete receipt protection cannot silently reach autoremove.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: protecting Brewfile formulae during cleanup.
Description check		The description directly explains the cleanup bug, the protection change, reproduction steps, and added tests.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[MikeMcQuaid]

Makes sense, thanks!